Depersonalization of personal data in the banking sector: Analysis of methods and selection of an implementation strategy
TL;DR
This article examines the pressing issue of personal data anonymization in credit and CFIs in the context of tightening regulatory requirements, in particular, Roskomnadzor Order No. 140, and determines the key requirements for the system under consideration.
Abstract
This article examines the pressing issue of personal data anonymization in credit and financial institutions (CFIs) in the context of tightening regulatory requirements, in particular, Roskomnadzor Order No. 140. It analyzes classic and modern anonymization methods (masking, pseudonymization, synthetic data generation, etc.) for their applicability in a banking environment where preserving data formats, referential integrity, and high performance are critical. A comparative assessment of three modern domestic solutions is provided: DataMask, Garda Data Masking, and N1 AI. Their systemic limitations are identified, including potential non-compliance with new regulations, insufficient flexibility for unique banking entities, and high cost of ownership. Based on this analysis, the strategic feasibility of developing a specialized internal anonymization tool is substantiated. This tool guarantees full regulatory compliance, maximum adaptability to the bank’s business processes, and long-term economic efficiency. A credit and financial institution is characterized by processing an extensive array of structured personal data (PD), which combines the features of general, other data, and information that constitutes bank secrecy. This information is typically stored in relational databases in a formalized format (separate fields for passport number, phone number, account number, etc.), which, on the one hand, simplifies their automated search, but on the other hand, requires strict protection measures, including secure anonymization for use in non-production environments. This determines the key requirements for the system under consideration: the need to accurately detect fields of various categories of financial and identifying information, and the use of masking algorithms that ensure irreversible conversion while preserving the structural integrity and data format for the correct operation of test systems.